User Tools

Site Tools

Linux Kernel Logging

Kernel code can log with the printk() call, which has the same basic signature as printf(). Most calls appear to have an initial argument specifying the log level, but this is in fact a string constant which relies on C string literal concatenation:

printk(KERN_CRIT "oops");

This log level can be any of the following:

Symbol

Value

Meaning

KERN_EMERG

“<0>”

Emergency messages (precede a crash)

KERN_ALERT

“<1>”

Error requiring immediate attention

KERN_CRIT

“<2>”

Critical error (hardware or software)

KERN_ERR

“<3>”

Error conditions (common in drivers)

KERN_WARNING

“<4>”

Warning conditions (could lead to errors)

KERN_NOTICE

“<5>”

Not an error but a significant condition

KERN_INFO

“<6>”

Informational message

KERN_DEBUG

“<7>”'

Used only for debug messages

KERN_DEFAULT

“<d>”

Default kernel logging level

KERN_CONT

“<c>”

Continuation of a log line (avoid adding new time stamp)

The printk() call is safe from any context within the kernel and is implemented as a call to the non-variadic vprintk().

In cases where code may produce large amounts of output (e.g. logging an error on receipt of a network packet), the function printk_ratelimit() can be used, which discards output which occurs after a configurable number of messages within a configurable time frame.

Within the kernel, log messages go to a ring buffer where they're then made available to user-space for logging to files. The flow within the kernel looks like:

Note:klogctl() is the glibc function wrapper, the underlying system call name is syslog(). Using that name would have caused confusion with the user-space syslog() call, however.

The log level is available for use by user-space daemons (e.g. syslog) to determine whether to place the message in a log file. There is an additional in-kernel threshold which determines whether the message is sent directly to the console, and also a configurable default level for printk() calls which don't specify a level of their own.

The klogctl() function can be used to read from the log and also clear it, as well as configure which log messages are sent to the console. The dmesg command-line utility uses this system call to provide access to the buffer, both to read and clear it.

In addition to the system call, there is a /proc interface which exports the following files: